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DETAILED ACTION 



1 . This Office Action is responding to the Amendment received on 1 1 /22/06. 

2. Claims 1,4-19, 21-27, 29-31, and 35-42 are pending. 



Response to Arguments 

3. Applicant's arguments filed 1 1/22/06 have been fully considered but they are not 
persuasive. 

4. As per remark on page 15-18, Applicant argues that Andrews does not discloses 
"the business logic module employs interaction-based definitions in which a component 
which performs the operation is defined by a series of request-response interaction 
definitions that can be satisfied to perform the operation" in the cited Column and lines. 
Examiner agrees with the applicant such limitation is not in the cited column and lines. 
Nevertheless, Andrews still discloses the system including Object Contexts and related 
services. 

(27) In summary, an object context is defined by its object context 
properties (e.g., a machine property, a process property, and an 
application property). If an object is in an object context having different 
object context properties from another object, the objects are said to be in 
different object contexts. A wrapper is automatically placed between 
references to objects residing in different object contexts by the object 
instantiation service of the operating system; the wrapper is provided with 
references to various policies as described below. The policies perform 
logic to establish an environment appropriate for the object context in light 
of the cross-context call. In the example, objects are associated with a 
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unique application identifier indicating to which application an object 
belongs. The application identifier is incorporated into the object's object 
context as one of the object context properties. Accordingly, objects in 
different applications are placed into different object contexts and a 
wrapper is interposed between thenn. Associated policies perform logic 
(e.g., security checking) appropriate for a cross-application call. 

(28) With reference now to FIG. 6, various objects execute in a process 
360 on a computer 354. The objects 370, 372, and 374 are members of 
one application and are accordingly placed in object context A; the objects 
390 and 392 are members of another application and accordingly are 
placed in object context B. When an object in one application attempts to 
access the functionality of an object in the other application, a wrapper is 
automatically interposed between the objects (e.g., the call 380 Is directed 
to a wrapper; the call 382 is not). The wrapper is provided with a 
reference to a security policy, which performs the various functions 
described above, such as enforcing an intra-process security boundary 
and enforcing method level security. 

5. The context of the object is the interaction-based definitions claims. The context 
properties of the object set conditions and limitations of interactions between the objects 
as per requested to perform an operation or process (Col 9 lines 1-35, and Col 13 lines 
25-38). Therefore, Andrew still anticipates the claimed invention. The rejection basis 
dated 08/24/06 is maintained. 



Claim Rejections - 35 USC § 101 



6. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

Claims 1, 4-18, and 35-42 are rejected under 35 U.S.C. 101 because the 
limitations in claims 1,4-7, and 40-42 are directed to software program module. In the 
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specification, Applicant refers the module as software module throughout (See 
Specification page 11 line 20, and page 13 line 25). 

Claims 8-18 recites a processor performing acts of the software functions similar 
to claim 1 . In some scenarios, a processor can be a software module processing 
information. Since the specification does not define or provide evidence or support the 
meaning of a processor, Claims 8-18 are also directing to software program or 
descriptive material. If the claimed processor is amended as "a computer processor", it 
would make claims 8-18 in statutory status. 

Claims 35-39 recites "An Architecture" comprising the software program module 
similar to claims 1, and 8. As reciting in the specification in Paragraph 19, the 
architecture is a software architecture. Such claiming is non-statutory. See below. 

ANNEX IV 

Computer-Related Nonstatutory Subject Matter 

Descriptive material can' be characterized as either "functional 
descriptive material" or "nonfunctional descriptive material." In this 
context, "functional descriptive material" consists of data structures 
and computer programs which impart functionality when employed as a 
computer component. (The definition of "data structure" is "a physical 
or logical relationship among data elements, designed to support 
specific data manipulation functions." The New IEEE Standard Dictionary 
of Electrical and Electronics Terms 308 (5th ed. 1993).) "Nonfunctional 
descriptive material" includes but is not limited to music, literary 
works and a compilation or mere arrangement of data.. 

Both types of "descriptive material" are nonstatutory when 
claimed as descriptive material per se. Warmerdam, 33 F.3d at 1360,31 
USPQ2d at 1759. When functional descriptive material is recorded on 
some computer-readable medium it becomes structurally and functionally 
interrelated to the medium and will be statutory in most cases since 
use of technology- permits the function of the descriptive material to 
be realized. Compare In re Lowry, 32 F.3d 1579, 1583-84, 32 
USPQ2d 1031, 1035 (Fed. Cir. 1994) (claim to data structure stored on a 
computer readable medium that increases computer efficiency held 
statutory) and Warmerdam, 33 F.3d at 1360-61, 31 USPQ2d at 
1759 (claim to computer having a specific data structure stored in 
memory held statutory product-by-process claim) with Warmerdam, 33 F.3d 
at 1361, 31 USPQ2d at 1760 (claim to a data structure per se held 
nonstatutory) 
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Claim Rejections - 35 USC § 102 

7. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 1 02 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 
applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed In the United States 
only if the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

8. Claims 1. 4-19, 21-27, 29-31, and 33-42 are rejected under 35 U.S.C. 102(e) as 
being anticipated by Andrews et al, US Patent No. 6487665B1, hereinafter "Andrews". 
(Cited in PTO 892 dated 6/03/05) 

9. As per claim 1: 

Andrew discloses "Andrew discloses "A system comprising: a pluggable security policy 
enforcement module configured to be replaceable in the system and to provide different 
granularities of control for a business logic in the system, wherein, business logic 
processes requests submitted to the system, wherein the business logic contains 
problem solving logic that produces solutions for a particular problem domain" in (Col 7 
lines 53-67, and Col 8 lines 25-50), "wherein the pluggable security policy enforcement 
module is configured to determine, for a particular granularity of control, whether to 
permit an operation, requested by a user based at least in part on a permission 
assigned to the user" in (Col 8 lines 25-50), and "wherein the business logic employs 
interaction-based definitions in which a component which performs the operation is 
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defined by a series of request-response interaction definitions that can be satisfied to 
perform the operation" in ( Col 9 lines 1-35, and Col 13 lines 25-38), and "wherein the 
different granularities of control comprise a plurality of sets of rules that can be replaced 
with each other without altering the business logic" in (Col 7 lines 60-67, Col 17 Ijnes 
42-65, and Col 1 1 lines 30-60 (A set of rules associates with each role of many roles. 
For instance, the user can call the method and can also control access at the 
application, object, and interface level in (Col 11 lines 55-60), and the manager can 
have other accesses. Each control access is a security or policy setting associating 
with the application, object, and interface level). 

10. As per claim 4: 

Andrew discloses "Andrew discloses "A system comprising: a pluggable security policy 
enforcement module configured to be replaceable in the system and to provide different 
granularities of control for a business logic in the system, wherein the business logic 
processes requests submitted to the system, wherein the business logic contains problem- 
solving logic that produces solutions for a particular problem domain" in (Col 7 lines 53-67, 
Col 8 lines 25-50, and Col 14 lines 27-45), and wherein the business logic employs 
interaction-based definitions in which a component which performs the operation is 
defined by a series of request-response interaction definitions that can be satisfied to 
perform the operation" in (Col 9 lines 1-35, and Col 13 lines 25-38) . "wherein the 
pluggable security policy enforcement module includes a control module configured to 
detemiine whether to pemiit an operation based at least in part on accessing the business 
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logic to identify one or nriore additional tests to perform, and further configured to perform the 
one or more additional tests" in (Col 1 1 lines 30-60, and Col 17 lines 43-58). 

11. As per claim 5: 

Andrew discloses "Andrew discloses "A system as recited in claim 4, wherein the control 
module is further configured to return a result of the detemnining to the business logic" in 
(Col 6 lines 57-65). 

12. As per claim 6: 

Andrew discloses "A system comprising: a pluggable security policy enforcement module 
configured to be replaceable in the system and to provide different granularities of control for 
a business logic in the system, wherein the business logic processes requests submitted to 
the system, wherein the different granularities of control comprise a plurality of sets of rules, 
and wherein each set of rules includes a plurality of permission assignment objects" in (Col 7 
lines 53-67, Col 8 lines 25-50, and Col 14 lines 27-45), and "wherein the business logic 
employs interaction-based definitions in which a component which performs the 
operation is defined bv a series of request-response interaction definitions that can be 
satisfied to perform the operation" in (Col 9 lines 1-35, and Col 13 lines 25-38) , 
"wherein each of the permission assignment objects associates a user with a 
particular role, wherein each particular role is associated with one or more permissions, and 
wherein each of the one or more permissions identifies a particular operation and context on 
which the operation is to be performed" in (Col 7 lines 60-67, Col 17 lines 42-65, and Col 
1 1 lines 30-60 (A set of rules associates with each role of many roles. For instance, the 
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user can call the method and can also control access at the application, object, and 
interface level in (Col 11 lines 55-60), and the manager can have other accesses. Each 
control access is a security or policy setting associating with the application, object, and 
interface level). 

13. As per claim 7:- 

Andrew discloses "A system as recited in claim 6, wherein each of the permission 
assignment objects further identifies whether the one or more permissions in the particular 
role are granted to the user or denied to the user'* in (Col 1 1 lines 29-60, and Col 17 lines 42- 
58). 

14. As per claim 8: 

Andrew discloses "One or more computer-readable media comprising computer-executable 
instructions that, when executed, direct a processor to perform acts including: 
receiving a request to perform an operation; checking whether to access a business logic in 
order to generate a result for the requested operation wherein the business logic contains 
problem-solving logic that produces solutions for a particular, problem domain" in (Col 7 
lines 53-67, Col 8 lines 25-50, and Col 14 lines 27-45); and "wherein the business logic 
employs interaction-based definitions in which a component which performs the 
operation is defined by a series of request-response interaction definitions that can be 
satisfied to perform the operation" in (Col 9 lines 1-35. and Col 13 lines 25-38) . 
"obtaining, from the business logic, a set of zero or more additional tests to be perfomned in 
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order to generate the result; performing each additional test in the set of tests if there is at 
least one test in the set of tests; 

checking a set of pluggable rules to determine the result of the requested operation; 

and 

returning, as the result, a failure indication if checking the business logic or checking 
the set of pluggable rules indicates that the result is a failure, otherwise returning, as the 
result, a success indication" in (Col 7 lines 60-67, Col 17 lines 42-65, and Col 11 lines 30- 
60 (A set of rules associates with each role of many roles. For instance, the user can 
call the method and can also control access at the application, object, and interface 
level in (Col 1 1 lines 55-60), and the manager can have other accesses. Each control 
access is a security or policy setting associating with the application, object, and 
interface level). 

15. As per claim 9: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
receiving comprises receiving, from the business logic, the request to perform the operation" 
in (Col 1 1 lines 29-60, and Col 17 lines 42-58). 

16. As per claim 10: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
receiving comprises receiving, as part of the request, an indication of a user, and wherein the 
checking the set of pluggable rules comprises comparing an object associated with the user 
to the rules in the set of pluggable mles and determining whether the operation can be 
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performed based at least in part on whether the user is permitted to perform the operation" 
in (Col 11 lines 29-60, and Col 17 lines 42-58). 

17. As per claim 11: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
receiving comprises having one of a plurality of methods invoked" in (Col 1 1 lines 29-60, and 
Col 17 lines 42-58). 

18. As per claim 12: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
set of pluggable rules is a set of security rules defined using high-level permission concepts" 
in (Col 1 1 lines 29-60, and Col 17 lines 42-58). 

19. As per claim 13; 

Andrew discloses "One or more computer-readable media as recited in claim 12, wherein the 
high-level permission concepts include an operation and a context, wherein the operation 
allows identification of an operation to be performed and the context allows identification of 
what the operation is to be performed on" in (Col 1 1 lines 29-60, and Col 17 lines 42-58). 

20. As per claim 14: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
computer-executable instructions are implemented as an object" in (Col 6 lines 57-65). 
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21. As per claim 15: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
computer-executable instructions further direct the processor to perform acts including: 
determining if at least one of the tests in the set of zero or more additional tests would 
indicate a result of failure; and returning, as the result, the failure indication without checking 
the set of pluggable rules" in (Col 1 1 lines 29-60, and Col 17 lines 42-58). 

22. As per claim 16: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein 
the set of pluggable rules can be replaced with another set of pluggable rules without 
altering the business logic" in (Col 7 lines 55-67, Col 11 lines 29-60, and Col 17 lines 
42-58). 

23. As per claim 17: 

Andrew discloses "One or more computer-readable media as recited in claim 8, wherein the 
set of pluggable rules includes a plurality of permission assignment objects, wherein each of 
the permission assignment object associates a user with a particular role, wherein each 
particular role is associated with one or more permissions, and wherein each of the one or 
more permissions identifies a particular operation and context on which the operation is to be 
performed" in (Col 1 1 lines 29-60. and Col 17 lines 42-58). 

24. As per claim 18: 

Andrew discloses "One or more computer-readable media as recited in claim 17, wherein 
each of the pemnission assignment objects further identifies whether the one or more 
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permissions in the particular role are granted to ttie user or denied to the user" in (Col 1 1 
lines 29-60, and Col 1 7 lines 42-58). 

25. As per claim 19: 

Andrew discloses "A method comprising: 

providing high-level permission concepts for security rules; 

allowing a set of security mles to be defined using the high-level permission concepts, 
wherein the set of security mles allows permissions to be assigned to users of an application; 
and determining, based at least in part on a permission assigned to a user, whether to permit 
an operation based on a request by the user, 

wherein the determining further comprises determining whether to pennit the. 
operation requested by the user based at least in part on accessing a business logic to the 
one or more additional tests, wherein the business logic contains problem-solving logic that 
produces solutions for a particular problem domain" in (Col 1 1 lines 29-60, and Col 17 lines 
42-58). and "wherein the business logic employs interaction-based definitions in which a 
component which performs the operation is defined by a series of request-response 
interaction definitions that can be satisfied to perform the operation" in (Col 9 lines 1-35, 
and Col 13 lines 25-38) . 

26. As per claim 21: 

Andrew discloses "A method as recited in claim 9 further comprising returning a result of the 
detennining to the business logic" in (Col 1 1 lines 29-60, and Col 17 lines 42-58). 
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27. As per claim 22: 

Andrew discloses "A method as recited in claim 19, wherein the high-level permission 
concepts include an operation and a context, wherein the operation allows identification of 
an operation to be performed and the context allows identification of what the operation is 
to be performed on" in (Colli lines 29-60. and Col 17 lines 42-58). 

28. As per claim 23: 

Andrew discloses "A method as recited in claim 19, wherein the method is implemented in an 
object having a plurality of interfaces for requesting a determination as to whether to permit a 
plurality of operations including the operation requested by the user" in (Col 11 lines 29-60, 
and Col 17 lines 42-58). 

29. As per claim 24: 

Andrew discloses "A method as recited in claim 19, wherein the set of security rules includes 
a plurality of permission assignment objects, wherein each of the permission assignment 
objects associates a user with a particular role, wherein each particular role is associated with 
one or more permissions, and wherein each of the one or more permissions identifies a 
particular operation and context on which the operation is to be perfomried" in (Col 1 1 lines 
29-60. and Col 1 7 lines 42-58). 

30. As per claim 25: 

Andrew discloses "A method as recited in claim 24, wherein each of the permission 
assignment objects further identifies whether the one or more permissions in the particular 
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role are granted to the user or denied to the user" in (Col 1 1 lines 29-60, and Col 17 lines 42- 
58). 

31. As per claim 26: 

Andrew discloses "A method comprising: 

receiving a request to perfonn an operation associated with business logic, wherein 
the business logic contains problem-solving logic that produces solutions for a particular 
problem domain" in (Col 7 lines 53-67, and Col 8 lines 25-50), and "wherein the business 
looic emplovs interaction-based definitions in which a component which performs the 
operation is defined bv a series of request-response interaction definitions that can be 
satisfied to perform the operation" in (Col 9 lines 1-35. and Col 13 lines 25-38) ; 

"accessing a set of low-level rules, wherein the low-level rules are defined in terms of 
high-level concepts; 

checking whether a user requesting to perform the operation is entitled to perform the 
operation based at least in part on the set of low-level rules; and 

returning an indication of whether the operation is allowed or not allowed, 
wherein the set of low-level rules can be replaced with another set of low-level rules without 
altering the business logic" in (Col 7 lines 60-67, Col 17 lines 42-65, and Col 11 lines 30- 
60 (A set of rules associates with each role of many roles. For instance, the user can 
call the method and can also control access at the application, object, and interface 
level in (Col 11 lines 55-60), and the manager can have other accesses. Each control 
access is a security or policy setting associating with the application, object, and 
interface level). 
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32. As per claim 27: 

Andrew discloses "A method as recited in claim 26, wherein the checking further 
comprises checking whether the user is entitled to perform the operation based at least in 
part on accessing the business logic to identify one or more additional tests to perform, and 
further comprising performing the one or more additional tests" in (Col 7 lines 55-67, Col 1 1 
lines 29-60, and Col 17 lines 42-58). 

33. As per claim 29: 

Andrew discloses "A method as recited in claim 27, further comprising returning the indication 
to the business logic" in (Col 7 lines 55-67, Col 1 1 lines 29-60, and Col 17 lines 42-58). 

34. As per claim 30: 

Andrew discloses "A method as recited in claim 26, wherein the low-level rules include a 
plurality of permission assignment objects, wherein each of the permission assignment 
objects associates a user with a particular role, wherein each particular role is associated with 
one or more permissions, and wherein each of the one or more permissions identifies a 
particular operation and context on which the operation is to be performed" in (Col 7 lines 
55-67, Col 11 lines 29-60, and Col 17 lines 42-58). 

35. As per claim 35: 

Andrew discloses "An architecture comprising: 
a plurality of resources; 

a business logic layer to process, based at least in part on the plurality of resources, 
requests received from a client, wherein the business logic layer contains problem-solving 
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logic that produces solutions for particular problem domain, and wherein the business logic 
employs interaction-based definitions in which a component which performs the 
operation is defined by a series of request-response interaction definitions that can be 
satisfied to perform the operation" in (Col 9 lines 1-35. and Col 13 lines 25-38) . and 

a pluggable security policy enforcement module, separate from the business layer, to 
enforce security restrictions on accessing information stored at the plurality of resources" in 
(Col 6 lines 56-65, Col 7 lines 53-67, and Col 8 lines 25-50). 

36. As per claim 36: 

Andrew discloses "An architecture as recited in claim 35, wherein the pluggable security 
policy enforcement module defines high-level permission concepts for security rules and 
further defines a set of security rules using the high-level permission concepts" in (Col 7 lines 
55-67, Col 1 1 lines 29-60, and Col 1 7 lines 42-58). 

37. As per claim 37: 

Andrew discloses "An architecture as recited in claim 36, wherein the high-level permission 
concepts include an operation and a context, wherein the operation allows identification of an 
operation to be performed and the context allows identification of what the operation is to be 
performed on" in (Col 7 lines 55-67, Col 1 1 lines 29-60, and Col 17 lines 42-58). 

38. As per claim 38: 

Andrew discloses "An architecture as recited In claim 35, wherein the pluggable security 
policy enforcement module can be replaced with another pluggable security policy 
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enforcement module to enforce different security restrictions without altering the business 
logic layer" in (Col 7 lines 55-67, Col 11 lines 29-60, and Col 17 lines 42-58). 

39. As per claim 39: 

Andrew discloses "An architecture as recited in claim 35, wherein the pluggable security 
policy enforcement module is configured to determine, based at least in part on a pemiission 
assigned to a user and on one or more additional tests identified by accessing the business 
logic layer, whether to permit an operation to access information at the plurality of resources" 
in (Col 7 lines 55-67, Col 1 1 lines 29-60, and Col 17 lines 42-58). 

40. As per claim 40: 

Andrew discloses "A system as recited in claim 1, wherein the system is configured as a 
multi-layer architecture, wherein the business logic is implemented as a business logic 
layer of the multi-layer architecture" in (Col 7 lines 55-67, Col 1 1 lines 29-60, and Col 17 
lines 42-58). 

41. As per claim 41 : 

Andrew discloses "A system as recited in claim 1 , wherein the pluggable security 
policy enforcement module is configured to receive an input from the business logic in 
the form of a user indication and an item indication" in (Col 7 lines 55-67, Col 11 lines 29- 
60, and Coll 7 lines 42-58). 

42. As per claim 42: 

Andrew discloses "A system as recited in claim 1, wherein the pluggable security policy 
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module includes an interface that provides the following interface functionality: first 
functionality for testing whether an identified item can be approved by a specified user; 
second functionality for testing whether the identified item of a specified type can be 
created by the specified user; third functionality for testing whether the identified item can 
be deleted by the specified user; fourth functionality -for testing whether the identified item 
can be modified by the specified user; and fifth functionality for testing whether, the identified 
user can examine details of the identified item" in (Col 7 lines 55-67. Col 1 1 lines 29-60, Col 
1 2 lines 47-52, and Col 1 7 lines 42-58). 

Conclusion 

43. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 



Application/Control Number: 09/847,037 



Page 19 



Art Unit: 2135 

44. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Linh LD Son whose telephone number is 571-272-3856. 
The examiner can normally be reached on 9-6 (M-F). 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on 571-272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 



Linh LD Son 
Examiner 
Art Unit 2135 
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